Analysis
- max time kernel
149s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
01/06/2024, 01:55
General
- Target df8d58b3fe317e2b06d1970bf69bbab21160cd8e0f2eb67e7192f1409e055832.jar
- Size 481KB
- Sample240601-ccmphadg8w
- SHA256 df8d58b3fe317e2b06d1970bf69bbab21160cd8e0f2eb67e7192f1409e055832
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\df8d58b3fe317e2b06d1970bf69bbab21160cd8e0f2eb67e7192f1409e055832.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\df8d58b3fe317e2b06d1970bf69bbab21160cd8e0f2eb67e7192f1409e055832.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\df8d58b3fe317e2b06d1970bf69bbab21160cd8e0f2eb67e7192f1409e055832.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\df8d58b3fe317e2b06d1970bf69bbab21160cd8e0f2eb67e7192f1409e055832.jar"4⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\df8d58b3fe317e2b06d1970bf69bbab21160cd8e0f2eb67e7192f1409e055832.jar"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
jna3343112182543454934.dll
83aa4cc77f591dfc2374580bbd95f6ba_215f2dba-ef84-4dd1-b127-5f514a0c233b
df8d58b3fe317e2b06d1970bf69bbab21160cd8e0f2eb67e7192f1409e055832.jar
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1084-267-0x000002502CCA0000-0x000002502CCA1000-memory.dmp
memory/1496-118-0x000001F0A47C0000-0x000001F0A47D0000-memory.dmp
memory/1496-66-0x000001F0A47D0000-0x000001F0A47E0000-memory.dmp
memory/1496-25-0x000001F0A4400000-0x000001F0A4401000-memory.dmp
memory/1496-26-0x000001F0A46F0000-0x000001F0A4700000-memory.dmp
memory/1496-29-0x000001F0A4700000-0x000001F0A4710000-memory.dmp
memory/1496-33-0x000001F0A4720000-0x000001F0A4730000-memory.dmp
memory/1496-32-0x000001F0A4420000-0x000001F0A4690000-memory.dmp
memory/1496-41-0x000001F0A4750000-0x000001F0A4760000-memory.dmp
memory/1496-40-0x000001F0A4740000-0x000001F0A4750000-memory.dmp
memory/1496-38-0x000001F0A4690000-0x000001F0A46A0000-memory.dmp
memory/1496-39-0x000001F0A4730000-0x000001F0A4740000-memory.dmp
memory/1496-30-0x000001F0A4710000-0x000001F0A4720000-memory.dmp
memory/1496-46-0x000001F0A4760000-0x000001F0A4770000-memory.dmp
memory/1496-45-0x000001F0A4770000-0x000001F0A4780000-memory.dmp
memory/1496-44-0x000001F0A46A0000-0x000001F0A46B0000-memory.dmp
memory/1496-48-0x000001F0A4780000-0x000001F0A4790000-memory.dmp
memory/1496-47-0x000001F0A46B0000-0x000001F0A46C0000-memory.dmp
memory/1496-54-0x000001F0A46C0000-0x000001F0A46D0000-memory.dmp
memory/1496-55-0x000001F0A4790000-0x000001F0A47A0000-memory.dmp
memory/1496-57-0x000001F0A46D0000-0x000001F0A46E0000-memory.dmp
memory/1496-58-0x000001F0A47A0000-0x000001F0A47B0000-memory.dmp
memory/1496-116-0x000001F0A48D0000-0x000001F0A48E0000-memory.dmp
memory/1496-65-0x000001F0A47C0000-0x000001F0A47D0000-memory.dmp
memory/1496-64-0x000001F0A46F0000-0x000001F0A4700000-memory.dmp
memory/1496-63-0x000001F0A47B0000-0x000001F0A47C0000-memory.dmp
memory/1496-115-0x000001F0A48C0000-0x000001F0A48D0000-memory.dmp
memory/1496-76-0x000001F0A4810000-0x000001F0A4820000-memory.dmp
memory/1496-75-0x000001F0A4800000-0x000001F0A4810000-memory.dmp
memory/1496-80-0x000001F0A4820000-0x000001F0A4830000-memory.dmp
memory/1496-77-0x000001F0A4710000-0x000001F0A4720000-memory.dmp
memory/1496-74-0x000001F0A47F0000-0x000001F0A4800000-memory.dmp
memory/1496-82-0x000001F0A4720000-0x000001F0A4730000-memory.dmp
memory/1496-83-0x000001F0A4830000-0x000001F0A4840000-memory.dmp
memory/1496-73-0x000001F0A47E0000-0x000001F0A47F0000-memory.dmp
memory/1496-72-0x000001F0A4700000-0x000001F0A4710000-memory.dmp
memory/1496-85-0x000001F0A4400000-0x000001F0A4401000-memory.dmp
memory/1496-87-0x000001F0A4730000-0x000001F0A4740000-memory.dmp
memory/1496-90-0x000001F0A4840000-0x000001F0A4850000-memory.dmp
memory/1496-89-0x000001F0A4750000-0x000001F0A4760000-memory.dmp
memory/1496-88-0x000001F0A4740000-0x000001F0A4750000-memory.dmp
memory/1496-117-0x000001F0A47B0000-0x000001F0A47C0000-memory.dmp
memory/1496-94-0x000001F0A4760000-0x000001F0A4770000-memory.dmp
memory/1496-93-0x000001F0A4770000-0x000001F0A4780000-memory.dmp
memory/1496-102-0x000001F0A4870000-0x000001F0A4880000-memory.dmp
memory/1496-100-0x000001F0A4860000-0x000001F0A4870000-memory.dmp
memory/1496-101-0x000001F0A4790000-0x000001F0A47A0000-memory.dmp
memory/1496-22-0x000001F0A46D0000-0x000001F0A46E0000-memory.dmp
memory/1496-120-0x000001F0A48E0000-0x000001F0A48F0000-memory.dmp
memory/1496-124-0x000001F0A4400000-0x000001F0A4401000-memory.dmp
memory/1496-119-0x000001F0A47D0000-0x000001F0A47E0000-memory.dmp
memory/1496-95-0x000001F0A4850000-0x000001F0A4860000-memory.dmp
memory/1496-23-0x000001F0A46E0000-0x000001F0A46F0000-memory.dmp
memory/1496-62-0x000001F0A46E0000-0x000001F0A46F0000-memory.dmp
memory/1496-114-0x000001F0A48B0000-0x000001F0A48C0000-memory.dmp
memory/1496-113-0x000001F0A48A0000-0x000001F0A48B0000-memory.dmp
memory/1496-112-0x000001F0A4890000-0x000001F0A48A0000-memory.dmp
memory/1496-111-0x000001F0A4880000-0x000001F0A4890000-memory.dmp
memory/1496-110-0x000001F0A47A0000-0x000001F0A47B0000-memory.dmp
memory/1496-129-0x000001F0A47F0000-0x000001F0A4800000-memory.dmp
memory/1496-133-0x000001F0A4900000-0x000001F0A4910000-memory.dmp
memory/1496-132-0x000001F0A48F0000-0x000001F0A4900000-memory.dmp
memory/1496-131-0x000001F0A4810000-0x000001F0A4820000-memory.dmp
memory/1496-130-0x000001F0A4800000-0x000001F0A4810000-memory.dmp
memory/1496-136-0x000001F0A4910000-0x000001F0A4920000-memory.dmp
memory/1496-135-0x000001F0A4820000-0x000001F0A4830000-memory.dmp
memory/1496-128-0x000001F0A47E0000-0x000001F0A47F0000-memory.dmp
memory/1496-99-0x000001F0A4780000-0x000001F0A4790000-memory.dmp
memory/1496-138-0x000001F0A4830000-0x000001F0A4840000-memory.dmp
memory/1496-139-0x000001F0A4920000-0x000001F0A4930000-memory.dmp
memory/1496-143-0x000001F0A4930000-0x000001F0A4940000-memory.dmp
memory/1496-141-0x000001F0A4840000-0x000001F0A4850000-memory.dmp
memory/1496-146-0x000001F0A4940000-0x000001F0A4950000-memory.dmp
memory/1496-144-0x000001F0A4850000-0x000001F0A4860000-memory.dmp
memory/1496-145-0x000001F0A4860000-0x000001F0A4870000-memory.dmp
memory/1496-149-0x000001F0A4950000-0x000001F0A4960000-memory.dmp
memory/1496-151-0x000001F0A4400000-0x000001F0A4401000-memory.dmp
memory/1496-157-0x000001F0A4960000-0x000001F0A4970000-memory.dmp
memory/1496-156-0x000001F0A4870000-0x000001F0A4880000-memory.dmp
memory/1496-158-0x000001F0A4880000-0x000001F0A4890000-memory.dmp
memory/1496-163-0x000001F0A4970000-0x000001F0A4980000-memory.dmp
memory/1496-162-0x000001F0A48C0000-0x000001F0A48D0000-memory.dmp
memory/1496-161-0x000001F0A48B0000-0x000001F0A48C0000-memory.dmp
memory/1496-160-0x000001F0A48A0000-0x000001F0A48B0000-memory.dmp
memory/1496-159-0x000001F0A4890000-0x000001F0A48A0000-memory.dmp
memory/1496-167-0x000001F0A48D0000-0x000001F0A48E0000-memory.dmp
memory/1496-168-0x000001F0A4980000-0x000001F0A4990000-memory.dmp
memory/1496-171-0x000001F0A4400000-0x000001F0A4401000-memory.dmp
memory/1496-173-0x000001F0A48E0000-0x000001F0A48F0000-memory.dmp
memory/1496-177-0x000001F0A48F0000-0x000001F0A4900000-memory.dmp
memory/1496-178-0x000001F0A4900000-0x000001F0A4910000-memory.dmp
memory/1496-179-0x000001F0A4910000-0x000001F0A4920000-memory.dmp
memory/1496-183-0x000001F0A4990000-0x000001F0A49A0000-memory.dmp
memory/1496-182-0x000001F0A4920000-0x000001F0A4930000-memory.dmp
memory/1496-187-0x000001F0A46A0000-0x000001F0A46B0000-memory.dmp
memory/1496-20-0x000001F0A46C0000-0x000001F0A46D0000-memory.dmp
memory/1496-17-0x000001F0A46B0000-0x000001F0A46C0000-memory.dmp
memory/1496-15-0x000001F0A46A0000-0x000001F0A46B0000-memory.dmp
memory/1496-186-0x000001F0A4690000-0x000001F0A46A0000-memory.dmp
memory/1496-185-0x000001F0A4420000-0x000001F0A4690000-memory.dmp
memory/1496-184-0x000001F0A4400000-0x000001F0A4401000-memory.dmp
memory/1496-2-0x000001F0A4420000-0x000001F0A4690000-memory.dmp
memory/1496-13-0x000001F0A4690000-0x000001F0A46A0000-memory.dmp
memory/2612-354-0x00000192DB780000-0x00000192DB781000-memory.dmp
memory/2612-372-0x00000192DB780000-0x00000192DB781000-memory.dmp